I'm looking at those schemes because I want to build an AEAD out of Poseidon, i.e., optimized for arithmetization. So while I won't answer the PQC KEM part of the question, I think the other parts are relevant.
Motorist and Keyak
Motorist is a parametrized lower-level primitive, on which Keyak is based. The most notable parameter to Motorist is the "Piston count" $\Pi$, which indicates a level of parallelism: the authors foresee that hardware implementations or SIMD implementations may be able to parallelize the use of multiple sponges.
Motorist looks a lot like STROBE from the outside. It takes an initial secret, unique value (SUV), which is either a key, or a key plus a nonce, and then processes messages and cryptograms in sequence. Motorist distributes the load over the $\Pi$ pistons.
Keyak is then simply an instantiation of Motorist with a specific form for the SUV. It ships in the five named instantiations you mentioned:
| Name |
b |
Π |
comment |
| River Keyak |
800 |
1 |
lightweight |
| Lake Keyak |
1600 |
1 |
high performance |
| Sea Keyak |
1600 |
2 |
high performance |
| Ocean Keyak |
1600 |
4 |
high performance |
| Lunar Keyak |
1600 |
8 |
high performance |
The Keyak paper mentions "Lake Keyak is the primary recommendation". My intuition here is that it's the simplest to implement: no need for distributing the load among multiple sponges, while retaining the large sponge capacity for larger throughput.
Kravatte
Kravatte comes originally from the Farfalle paper, and is the application of the Farfalle transformation on the Keccak permutation.
- Kravatte-SANE, a simple AEAD mode
- Kravatte-SANSE, a SIV mode, nonce misuse resistant
Cyclist and Xoodyak
Cyclist and Xoodyak relate the same way that Motorist and Keyak do.
For details, see the Xoodoo cookbook. There seems to be quite some history pertaining to Xoodoo (a permutation), Xoofff (a deck function building on Xoodoo), Cyclist (a Motorist-like mode of operation), and Xoodyak (a STROBE-like framework based on Xoodoo).
The Xoodoo cookbook states about Xoodyak in section 7:
It is simpler than Motorist, mainly thanks to the absence of parallel
variants. Another important difference is that Cyclist is not limited
to authenticated encryption, but rather offers fine-grained services,
à la Strobe, and supports hashing.
Ketje and MonkeyWrap
MonkeyWrap is an authenticated encryption mode, like Motorist and Cyclist, which applied to certain Keccak instantiations yields Ketje ("ketje" is Brussels slang for a person from Brussels, but I'm not sure whether that's the aim).
Ketje aims at the most extreme end of lightweight devices, by using round-reduced Keccak permutations. MonkeyDuplex and MonkeyWrap support dynamically changing the number of rounds, depending on the calls made by the primitive on top. To guarantee security, the construction relies on good nonce management.
Conclusions
Keyak and Ketje have both been CAESAR 3rd round candidates, but neither has won, because of their lacking performance.
Kravatte and Xoodyak have not entered any such competition, as far as I know, and might thus lack some cryptanalytic history. Kravatte seems to me the most "classical" AEAD primitive, while Keyak, Ketje and Xoodyak offer quite some more flexibility.
It might also be noteworthy to talk about the timeline here. It seems to me that the Kravatte family was the first AEAD construction to sprout out of Keccak. After Kravatte, the Keccak team also published Keyak and Ketje, to cover some more ground. The broken parts of Kravatte were then later fixed by Xoodoo. The Xoodoo cookbook makes a comparison to Keyak, but not to Ketje.
To me, it seems that Xoodoo/Xoodyak and Ketje are the two primitives to be used for new designs, if you want to rely on the Keccak team's work. Keyak is the choice instead of Xoodyak if you want a CAESAR submission, or want a simple AEAD based on the standard Keccak permutation instead of Xoodoo.
